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IN THE CLAIMS: 

This listing of claitns will replace all prior versions, and listings^ of claims in the application. 

Listing of Claims 

I. -9. (Cancelled) 

10. (Currently amended) A method for detecting the presence of a computer virus, the 
method comprising; 

receiving, at a bait server, a request For access to poifonn a flmotion on the bait server^ 
wherein the bait server's address is not published to a network and wherein receipt of the request 
indicates that a virus attaek is m progress: 

identifying an offending system from which the request originated; 

alerting a local server that [[a]] fee virus attack is in progress and of the identity of the 
offending system; and 

disconnecting the offending system dom the network, 

I I . (Original) The method as recited in claim 1 0, further comprisitig: 

prior to disconnecting the offending system, notifying the offending system that it is 
mfeoted with a virus. 

12. (Original) The method as redted in claim 10, further comprising: 

receiving a reconnect request from the offending system; 

verifying that the ofifcnding system is disinfected and available to reconnect to the 
network; and 

recormecting the offending system to the network. 

13" (CanceUed) 
14. (Cancelled) 
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15. (Cancelled) 

1 6 . (Currently amended) A method in a bait server for detecting the presence of a computer 
virus, the method comprising: 

not publishing the bait server's address to a network; 

receivinjz a request for access ftom the network, wherein receipt of t he request indicates 
that a virus is present: 

monitoring th e network for the pr e DBpo fl of a oomputor ^rirufl; 

roBponoiv e to a d e tBrmination that a virus i s dotootod, detemiining the identity of an 
offending system within the network from which the virus entered the network; 

notifying a local server of the presence of the virus and the identity of the offending 

system; 

instracting all devices within the network to ignore all requests from the offending system 
until the offending system has been disinfected and is available for network commuDication; 
directh^ the local server to disconnect the offending system from the network; and 
responsive to an indication that the offending system has been disinfected and responsive 
to a reconnect request from the offending system to the local server, reconnBcting the offending 
system to the network, 

17. (Previously presented) The method as recited in claim 1 0» Airther comprising: 
instructing all devices within the network to ignore all requests from the offending system 

until the offending system has been disinfected and is available for network communication, 

18. (Cancelled) 

19. (Cancelled) 

20. (Currently amended) A computer program product in a computer readable media for use 
in a data processing system fbr detecting the presence of a computer virus, the computer program 
product comprising; 
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first instructions for receiving, at a bait server, a request for acceM t o porfonn q ftmotion 
^ th:e bait serve r, wherein the bait aerver'a address is not published to a netw ork and wherein 
receipt of the request indicates that a virus attack is in proeress : 

second instnicticms for identifying an offending system from which the request 
originated; 

third instructions for alerting a local server that [[«]] Ifes virus attack is in progress and the 
identity of the offending system; and 

fourth instructions for disconnecting the offending system from [[a]] flie network- 

21, (Original) The computer program product as recited in claim 20, further comprising; 
fifth instructions for» prior to disconnecting the offending system, notifying the offending 

system that it is infected with a virus. 

22. (Original) The computer program product as recited in claim 20, further comprising: 
fifth instructions for receiving a reconnect request from the offending system; 

sixth instructions for verifying that the offending system is disinfected and available to 
recoimectto the network; and 

seventh instructions for reconnecting the offending system to the network. 

23. (CanceUed) 

24. (Cancelled) 

25, (Cancelled) 

26, (Currently amended) A computer program product in a computer readable media for use 
in a data processing system in a bait server for detecting the presence of a computer vims, the 
computer program product comprising: 

first instructions for not publishing the bait server's address published to a network; 
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second instructions for monitoring th e n e twork for th e prw e no e of a oomput e r viruo; 
receiving a request for access Aom the network, wherein receipt of the request indicates that a 
virus is present: 

third instmctionar teep e nQiv e to a det e rmination that a vinia in dotootod, for deterraining 
the identity of an offending system within die network from which the virus entered the network; 

fourth instructions for notifying a local server of the preserice of the virus and the identity 
of the offending system; 

fLEth instructions for instructing all devices within the network to ignore all requests ficm 
the offending system until the offending system is reauthorized for network communication; 

sixth instructions for directing a local server to disconnect the offending system ftom the 
network; and 

seventh instructions, responsive to an indication that the offending system has been 
disinfected and responsive to a reconnect request from the offending system to the local server, 
for reconnecting the offending system to the network. 

27. (Previously presented) The computer program product as necited in claim 20, ftirther 
comprising: 

fifth instructions for instructing all devices within the network to ignore all requests from 
the offending system tmtil the offending system is reauthorized for network communication. 

28. (Cancelled) 

29. (Cancelled) 

30. (Currently amended) A system for detecting the presence of a computer virus, the system 
comprising; 

a receiver, at a bait Berver, which receives a request for access to perform a funotion - cHi 
the bait serve r, wherein the bait server's address is not pubhshed to a network and wherein 
receint of the request indicates that a virus attack is in nrogress: 

an identifying unit which identifies an offending system &om which the request 
originated; 
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[ea] a virus alert unit which alerts a local server that [[a]] ij^ virus attack is in progress 
and the identity of the offending system; and 

a disconnection unit which disconnects the offending system Scorn [[ft]] SiS network. 

3 1 . (Original) The system as recited in claim 30, further comprising: 

a notification unit which, prior to disconnecting the offending system, notifies the 
offending system that it is infected with a virus , 

32. (Original) The system as recited in claim 30, further comprising; 

a reconnect request unit which receives a reconnect request firom the offending system; 
a veriftcation unit which verifies that the ofTmding system is authorized to reconnect to 
the network; and 

a reconnecting unit which reconnects the offending system to the network. 

33. (Cancelled) 

34. (Cancelled) 

35. (Cancelled) 

36. (Currently amended) A system in a bait server for detecting the presence of a compute 
vbrus, the system comprising: 

a monitoring receiving unit which receives a request for access fix)m a networks monitor s 
a n e twork for th e pr e flenoo of a oomputor viruS g wherein the bait server *s address is not published 
to the network and wherein receipt of the request indicates that a virua is present: 

an identifier unit whic h, rosponflivo to a d e tgrniination that a viiuo lo d e tootod, determines 
the identity of an offending system within the network from which the virus entered the network; 

a notification unit which notifies a local server of the presence of the virua and the 
identity of the offending system; 
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a network protection unit which instructs all devices within the network to ignore all 
requests from the offending system until the offending system is reauthorized for network 
conrnnmication; [[ef^]] 

a disconnection unit which directs a local seiver to disconnect the offending system &om 
the network[[r]l : and 

a reconnection unit which, responsive to an indication that the offending system has been 
disinfected and responsive to a reconnect request from the offending system to the local server, 
reconnects the offending system to the network^ 

37. (Previoiialy presented) The system as recited in claim 30, fUrther comprising: 

a network protection unit which instructs all devices within the network to ignore all 
requests from the offending system until the offending system is reauthorized for network 
communication. 

38. (Cancelled) 

39. (Cancelled) 
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